Home/ Questions/Q 485671
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-13T01:25:31+00:00

I’m not sure whether my SQL code and practise here is any good, so

  • 0

I’m not sure whether my SQL code and practise here is any good, so hopefully someone could enlighten me. In order to try and separate my DAL from the Business layer, I’m not using an SQLDataSource on the page. Instead, I’ve created a gridview to display the results and called an SQL command to retrieve results. I have the following SQL command:

string CommandText = "SELECT User.FName + User.Surname, Product.Name, Product.Quantity, Product.Price FROM User, Products WHERE Product.UserID = User.UserID";

The results are then loaded into a datareader and bound to the gridview control. This works fine. However, is the SQL statement inefficient? I’ve noticed some SQL statements have square brackets around each field, but when I try and put it around my fields, no results are displayed.
I’m also trying to merge the firstname and surname into one column, with a space between them, but the above doesn’t put a space between them, and I can’t seem to add a space in the SQL statement.

Finally, this all occurs in the code-behind of the shopping-cart page. However, is it insecure to have the connectionstring and above SQL statement in the codebehind? My connectionstring is encrypted within the web.config file and is called via the Configuration API.

Thanks for any help.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Firstly, using square brackets is optional in most cases (IIRC, there are very few instances where they are actually necessary, such as using keywords in the statement). Square brackets go around each identifier, for example,

    SELECT [Server_Name].[Database_Name].[Table_Name].[Field_Name], ...

    Secondly, to add a space, you can use SELECT User.FName + ' ' + User.Surname. You also might want to alias it – SELECT User.FName + ' ' + User.Surname AS [name]

    Thirdly, keep the connection string in the web.config and encrypt it using a key.

    Finally, you may want to consider introducing a data access layer into the project that can return objects from your datasource (might be worth having a look at NHibernate, LINQ to SQL or Entity Framework for this). You can then bind a collection of objects to your GridView.

    • 0